Overview
To understand SQL injection, you first need a basic grasp of SQL — the language applications use to query relational databases. This lesson provides the minimal SQL background needed to see how injection arises and how to prevent it.
Learning objectives
- Describe what SQL is and the common statement types.
- Understand how applications build and run SQL queries.
- See where user input enters a query.
Core concept
SQL (Structured Query Language) is the standard language for relational databases. Core statement types:
- SELECT — read data (
select ... from ... where ...). - INSERT / UPDATE / DELETE — create, modify, remove data.
A query mixes query structure (keywords, table/column names, operators) with data values (the specific values being searched or stored). Applications frequently build queries that include user-supplied values — for example, a search term or a login username — in the WHERE clause.
How it works
When an application needs data based on user input, it constructs a SQL statement incorporating that input and sends it to the database, which parses and executes it. The critical distinction is between the query's code (its structure and commands) and its data (the values). The database decides what to do based on the parsed statement. If user input is allowed to alter the structure rather than being confined to a value, the query's meaning can change — which is the seed of SQL injection, explored in the next lesson.
Practical example
A product search conceptually runs: "SELECT the products WHERE name matches the user's search term." The search term should be pure data — a value the query compares against. Whether the application keeps it as data (safe) or lets it merge into the query's code (unsafe) determines security. Understanding that a query has fixed structure plus variable data is the key mental model before examining how injection abuses that boundary.
Cybersecurity relevance
SQL underlies most web applications' data access, and nearly all of them incorporate user input into queries. The security of that incorporation — keeping input as data, never letting it become code — is what separates safe applications from those vulnerable to injection. This basic SQL literacy is the prerequisite for recognizing vulnerable patterns, understanding the impact of injection, and applying the correct defense (parameterized queries) in the lessons that follow.
Common mistakes
- Not distinguishing query code from query data, the core idea behind injection.
- Assuming the database validates intent — it executes the statement as parsed, whatever it means.
- Overlooking that many query types (not just SELECT) can be targeted.
Key takeaways
- SQL is the language for relational databases; common statements are SELECT (read) and INSERT/UPDATE/DELETE (modify).
- A query combines fixed structure (code) with variable values (data); applications often embed user input as values.
- The safety of a query depends on keeping user input as data and never letting it alter the query's structure — the foundation for understanding SQL injection.
Check your understanding
- What is the difference between the "code" and the "data" parts of a SQL query?
- Where in a typical query does user-supplied input usually appear?